For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Virtualrana_132's avatar
Virtualrana_132
Icon for Nimbostratus rankNimbostratus
Nov 07, 2014

HSTS - Header not inserted with iRule

Hi,   Following is my iRule which is attached to $mydomain$ (http) VirtualServer in F5 for HSTS, but it is not inserting the "Strict-Transport-Security" header in the http response. When I run "cu...
Virtualrana_132's avatar
Virtualrana_132
Icon for Nimbostratus rankNimbostratus
Nov 09, 2014

Hi Guys... Thank you for your responses.

 

@ Eastman: I've added the bit you mentioned and following is how the iRule looks like. Still no luck and the log shows nothing.

 

====

 

iRule for HSTS HTTP Virtuals

when HTTP_REQUEST { HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" }

 

when HTTP_RESPONSE { HTTP::header insert Strict-Transport-Security "max-age=31536000"

 

foreach headerName [HTTP::header names] { append headerNames " |$headerName: [HTTP::header value $headerName]" }

 

log local0. "$headerNames"

 

}

 

====

 

@ bepsoccer: My understanding: I applied the iRule to http VS as the first line of the iRule is HTTP REDIRECT, so i didn't apply the iRule to HTTPS VS. Please correct me if I am wrong.

 

Thanks guys, appreciate your help.

 

Rana